Security Threat Response Manager Release 2013.1 Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA 408-745-2000 www.juniper.net Published: 2013-03-15
Copyright Notice Copyright 2013 Juniper Networks, Inc. All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. The following terms are trademarks or registered trademarks of other companies: Java TM and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. FCC Statement The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with NetScreen s installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/tv technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected. Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device. Disclaimer THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT, SUBJECT TO THE MODIFICTAIONS SET FORTH BELOW ON THIS PAGE, ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY. Release 2013.1 Copyright 2013, Juniper Networks, Inc. All rights reserved. Printed in USA. Revision History March 2013 The information in this document is current as of the date listed in the revision history. END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at http://www.juniper.net/support/eula.html, as modified by the following text, which shall be treated under the EULA as an Entitlement Document taking precedence over any conflicting provisions of such EULA as regards such software: As regards software accompanying the STRM products (the Program ), such software contains software licensed by Q1Labs and is further accompanied by third-party software that is described in the applicable documentation or materials provided by Juniper Networks. 2
For the convenience of Licensee, the Program may be accompanied by a third party operating system. The operating system is not part of the Program, and is licensed directly by the operating system provider (e.g., Red Hat Inc., Novell Inc., etc.) to Licensee. Neither Juniper Networks nor Q1 Labs is a party to the license between Licensee and the third party operating system provider, and the Program includes the third party operating system AS IS, without representation or warranty, express or implied, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement. For an installed Red Hat operating system, see the license file: /usr/share/doc/redhat-release-server-6server/eula. By downloading, installing or using such software, you agree to the terms and conditions of that EULA as so modified. 3
4
CONTENTS ABOUT THIS GUIDE Documentation Conventions............................................ 5 Technical Documentation............................................... 5 Contacting Customer Support........................................... 6 1 OVERVIEW Using the Adaptive Log Exporter......................................... 8 Using the Menu.................................................... 9 Using the Toolbar.................................................. 9 Using the Preferences Window...................................... 11 2 INSTALLING THE ADAPTIVE LOG EXPORTER Before You Begin.................................................... 13 Installing the Adaptive Log Exporter..................................... 14 Installing and Configuring ALE Using the CLI.............................. 15 Basic Adaptive Log Exporter CLI Installation............................ 16 Advanced Installation with Windows Event Log Monitoring................. 17 Adaptive Log Exporter CLI Utility Examples............................. 19 Uninstalling the Adaptive Log Exporter................................... 21 3 CONFIGURING ADAPTIVE LOG EXPORTER UPDATES Configuring the Update Site............................................ 23 Configuring Updates for Off-line Sites.................................... 25 Scheduling Automatic Updates......................................... 26 Configuring Automatic Update Preferences................................ 27 4 MANAGING DESTINATIONS Configuring Destinations.............................................. 29 Adding a Syslog TCP Destination..................................... 30 Adding a Syslog UDP Destination.................................... 31 Adding a Logger Destination........................................ 32 Editing a Destination............................................... 33 Deleting a Destination.............................................. 33
5 CONFIGURING CISCO ACS Configuring Cisco ACS................................................35 Configuring the Cisco ACS Device Plug-in..............................35 Creating a Device Mapping..........................................36 6 CONFIGURING THE CISCO CSA DEVICE Configuring Cisco CSA................................................39 Configuring the Cisco CSA Device Plug-in..............................39 Creating a Device Mapping..........................................41 7 CONFIGURING A FILE FORWARDER DEVICE Configuring a File Forwarder...........................................44 Configuring the File Forwarder Device Plug-in...........................44 Creating a Device Mapping..........................................46 8 CONFIGURING THE XML FILE FORWARDER DEVICE Configuring an XML File Forwarder......................................47 Configuring the XML File Forwarder Device Plug-in.......................48 Creating a Device Mapping..........................................50 9 CONFIGURING JUNIPER STEEL-BELTED RADIUS (SBR) Configuring Juniper Steel-Belted Radius..................................53 Configuring the Juniper SBR Device Plug-in.............................53 Creating a Device Mapping..........................................55 10 CONFIGURING THE NETAPP DATA ONTAP DEVICE Configuring NetApp Data ONTAP.......................................57 Configuring the NetApp Data ONTAP Device Plug-in......................58 Creating a Device Mapping..........................................59 11 CONFIGURING THE WINDOWS EVENT LOG DEVICE Configuring Windows Event Log........................................62 Configuring the Windows Event Log Device Plug-in.......................62 Creating a Device Mapping..........................................64 12 CONFIGURING THE MICROSOFT DHCP DEVICE Configuring a Microsoft DHCP Device....................................67 Configuring the Windows DHCP Device Plug-in..........................67 Creating a Device Mapping..........................................68 13 CONFIGURING THE TREND MICRO INTERSCAN VIRUSWALL DEVICE Configuring an Trend Micro Device......................................71 Configuring the Trend Micro InterScan VirusWall Device Plug-in.............72
Creating a Device Mapping......................................... 73 14 CONFIGURING THE MICROSOFT EXCHANGE SERVER DEVICE Configuring Microsoft Exchange OWA.................................... 76 Enabling Exchange OWA Logs using IIS 6.x............................ 76 Enabling Exchange OWA Logs using IIS 7.x............................ 77 Configuring the Microsoft Exchange Server OWA Plug-in.................. 78 Creating a Device Mapping......................................... 79 Forwarding Microsoft Exchange SMTP Logs............................... 79 Enabling Microsoft Exchange 2003 SMTP Logs.......................... 80 Configuring the Microsoft Exchange Server SMTP Plug-in................. 80 Creating a Device Mapping......................................... 81 15 CONFIGURING THE MICROSOFT SQL SERVER DEVICE Configuring a Microsoft SQL Server Device............................... 83 Configuring the Microsoft SQL Device Plug-in........................... 84 Creating a Device Mapping......................................... 85 16 CONFIGURING THE MICROSOFT IIS DEVICE Configuring a Microsoft IIS Server Device................................. 88 Configuring the Microsoft IIS Server Device Plug-in....................... 88 Creating a Device Mapping......................................... 90 17 CONFIGURING THE MICROSOFT WINDOWS IAS DEVICE Configuring a Microsoft IAS Device...................................... 91 Configuring the Windows IAS Device Plug-in............................ 92 Creating a Device Mapping......................................... 93 18 CONFIGURING THE MICROSOFT ISA DEVICE A Configuring Windows ISA............................................. 95 Configuring the Windows ISA Device Plug-in............................ 96 Creating a Device Mapping......................................... 97 TROUBLESHOOTING Troubleshooting Files................................................. 99 Update Site Unreachable............................................. 100 Verifying Devices are Creating Events................................... 101 Creating a Logger Destination...................................... 101 Deleting a Logger Destination...................................... 102 Verifying STRM is Receiving Events.................................... 103 Configuring Adaptive Log Exporter Service Credentials..................... 103 Troubleshooting Common Error and Warning Messages.................... 105 Example: Remote Permissions...................................... 105 Example: Event Per Second Overload................................ 105 Example: Unexpected Value in Payload............................... 106 Enabling the Print Spooler............................................ 106
B C UPDATING REMOTE WINDOWS EVENT LOG DEVICES USING THE CLI Patching the Windows Event Log Device..............................107 Updating a Windows Event Log Configuration..........................108 Updating Examples...............................................110 SUPPORTED DEVICE PLUG-INS
ABOUT THIS GUIDE The Adaptive Log Exporter guide provides you with information for configuring device plug-ins and receiving events from Windows hosts within your network. Audience This guide is intended for the system administrator responsible for setting up Adaptive Log Exporter in your network. This guide assumes that you have STRM administrative access and a knowledge of your corporate network and networking technologies. Documentation Conventions Table 1 lists conventions that are used throughout this guide. Table 1 Icons Icon Type Information note Information that describes important features or instructions. Caution Warning Information that alerts you to potential loss of data or potential damage to an application, system, device, or network. Information that alerts you to potential personal injury. Technical Documentation You can access technical documentation, technical notes, and release notes directly from the Juniper customer support website at https://www.juniper.net/support/. Once you access the Juniper customer support website, locate the product and software release for which you require documentation. Your comments are important to us. Please send your e-mail comments about this guide or any of the Juniper Networks documentation to: techpubs-comments@juniper.net. Include the following information with your comments: Document title
10 ABOUT THIS GUIDE Page number Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support contract, or are covered under warranty, and need postsales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at http://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf. Product warranties For product warranty information, visit http://www.juniper.net/support/warranty/. JTAC Hours of Operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: http://www.juniper.net/customers/support/ Search for known bugs: http://www2.juniper.net/kb/ Find product documentation: http://www.juniper.net/techpubs/ Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/ Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/ Search technical bulletins for relevant hardware and software notifications: https://www.juniper.net/alerts/ Join and participate in the Juniper Networks Community Forum: http://www.juniper.net/company/communities/ Open a case online in the CSC Case Management tool: http://www.juniper.net/cm/ To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: https://tools.juniper.net/serialnumberentitlementsearch/ Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Management tool in the CSC at http://www.juniper.net/cm/. Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico). For international or direct-dial options in countries without toll-free numbers, visit us at http://www.juniper.net/support/requesting-support.html.
1 OVERVIEW The Adaptive Log Exporter is an independent application that runs on a Windows-based host, that is capable of collecting Windows-based or third party device logs and forwarding events to your STRM Console or Event Collector. Each installation of the Adaptive Log Exporter uses an Adaptive Log Exporter service to forward events to STRM. NOTE The Adaptive Log Exporter supports a maximum of 20 devices per installation. The Adaptive Log Exporter supports two installation configurations: Local - The Adaptive Log Exporter is installed locally on every host in your network. Each individual host supporting the Adaptive Log Exporter is responsible for collecting local event logs and forwarding the information to STRM. Local installations require more effort to install and configure, but does not impact performance on the host system as much as collecting logs from remote Windows-based workstations. One-to-many - The Adaptive Log Exporter is installed on a single host and configured to poll remote Windows-based operating systems for their event logs. One-to-many event collection is only supported using the Windows Event Log device plug-in, but allows the collection of event logs from multiple Windows servers or workstations. Collecting logs from a Windows system requires using NETBIOS, which is a relatively slow method of communication. Therefore, remotely collecting logs from several Windows-based hosts can cause a significant performance impact for the server hosting the Adaptive Log Exporter. NOTE The Window Event Log is the only Adaptive Log Exporter device plug-in that supports remote event collection using the Remote Machine check box.
12 OVERVIEW The Adaptive Log Exporter supports remote polling of event logs from the following operating systems: - Microsoft Windows 2000 - Microsoft Windows 2003 server - Microsoft Windows 2008 server - Microsoft Windows XP - Microsoft Windows 7 NOTE Remote event collection in a one-to-many configuration requires the Adaptive Log Exporter to be configured with domain administration credentials to access remote event logs. Supplying these credentials can be considered a security risk. For more information, see Configuring Adaptive Log Exporter Service Credentials. Both methods of event collection result in information being transmitted to STRM using syslog. By default, STRM automatically discovers and normalizes Windows event logs. After receiving events from the Adaptive Log Exporter, STRM can analyze, report, and store the information. To verify that your Windows logs are being processed by STRM, use the search function in the Log Activity tab to filter by the source or destination IP addresses of the devices configured in your Adaptive Log Exporter. For more information on filtering for events using the Log Activity tab, see the STRM Users Guide. Using the Adaptive Log Exporter The Adaptive Log Exporter provides a number of menu, tool bar, and preference options. This section provides information on the following topics: Using the Menu Using the Toolbar Using the Preferences Window
Using the Adaptive Log Exporter 13 Using the Menu The Adaptive Log Exporter includes the following menu options: Table 1-1 Adaptive Log Exporter Menu Options Menu Sub-Menu File Save Allows you to save current changes. Save All Allows you to save all changes made during the current session. Deploy Allows you to deploy all changes made during the current session. Preferences Allows you to configure Adaptive Log Exporter preferences. For more information, see Configuring Adaptive Log Exporter Updates. Exit Allows you to exit the application. Edit Edit Device Allows you to edit the settings for a currently saved device. Edit Destination Allows you to edit the mapping destination for a device. For more information, see Managing Destinations. Window Show Views Allows you to view the Destination or Devices tabs. Help Software Updates About Allows you to check for software updates. For more information, see Configuring Adaptive Log Exporter Updates. Allows you to view the Adaptive Log Exporter version information. Using the Toolbar The toolbar provides the following buttons: Toolbar Options Icon Save Allows you to save the current device or destination tab. Tabs with unsaved changes are indicated with an asterisks (*) symbol. Save All Allows you to save all device or destination tabs that contain changes. Tabs with unsaved changes are indicated with an asterisks (*) symbol. Edit Device Allows you to edit the settings of the selected device. This toolbar button is only available when you select a device that has been previously saved on the Devices tab. Edit Allows you to edit the destination for a device. Destination This toolbar button is only available when you select a destination that has been previously saved on the Destination tab.
14 OVERVIEW Toolbar Options (continued) Icon Deploy Add Plugins Allows you to deploy all changes made during the current session. This toolbar button is available after you have saved a device configuration or destination. Allows you to manually check for updated device plug-ins using the Install/Update site you configured in the preferences for the Adaptive Log Exporter. If you receive an error that states the update site is invalid, you must configure the update site in the Adaptive Log Exporter preferences. For more information, see Configuring the Update Site.
Using the Adaptive Log Exporter 15 Using the Preferences Window The Preferences window provides the following options: Table 1-1 Preference Options Menu Sub-Menu Help Install/Update Automatic Updates Update Site We recommend that you use the default values for the Help options. Select this option to configure your update options. For more information, see Configuring Automatic Update Preferences. Select this option to schedule device and application plug-in updates to your Adaptive Log Exporter. For more information, see Scheduling Automatic Updates. Select this option to configure the directory path or website the Adaptive Log Exporter uses for updates to download updated plug-ins. For more information, see Configuring the Update Site. NOTE If you change the default values of the Adaptive Log Exporter and you want to restore default values, select File > Preferences, and then click Restore Defaults.
2 INSTALLING THE ADAPTIVE LOG EXPORTER The Adaptive Log Exporter supports two methods of installation: Standard - A standard Adaptive Log Exporter installation is a guided installation on the local host using an install wizard. Command Line - The command line installation (CLI) allows you to use advanced installation parameters for remotely installing the Adaptive Log Exporter or configuring Windows events. NOTE The Adaptive Log Exporter does not support packaging of a bulk installer, but does provide the command line for remote bulk installations, which can be scripted. If you require assistance on packaging methods, please contact www.juniper.net/support/. This section includes the following topics: Before You Begin Installing the Adaptive Log Exporter Installing and Configuring ALE Using the CLI Uninstalling the Adaptive Log Exporter Before You Begin Before you begin installing the Adaptive Log Exporter, you must ensure the Windows-based host of the Adaptive Log Exporter meets the following requirements: A 32-bit or 64-bit Windows-based operating system. The Adaptive Log Exporter supports the following operating systems: - Windows 2000 - Windows 2003 server - Windows 2008 server - Windows XP - Windows 7 A minimum of 200 MB of available disk space is required. An enabled print spooler service on every Adaptive Log Exporter host.
18 INSTALLING THE ADAPTIVE LOG EXPORTER Installing the Adaptive Log Exporter Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Before installing the Adaptive Log Exporter using the installation wizard, close all active applications. To install the Adaptive Log Exporter: Download the AdaptiveLogExporter_setup.zip file from the Juniper customer support website. https://download.juniper.net/software/strm/2012.1/adaptivelogexporter_setup.zip Copy the file to the Adaptive Log Exporter host or a local Windows share. Extract the file. You must keep the folder and directory structure intact when you extract the AdaptiveLogExporter_setup.zip file. Double-click the setup file to launch the installation wizard. The Welcome window is displayed. Click Next. The End User License Agreement (EULA) is displayed. Read the license agreement information in the window and select I accept the agreement to continue. If you select I do not accept the agreement, you cannot continue with the installation. Click Browse or type the installation location for the Adaptive Log Exporter and then click Next. From the list box, select Full installation. This option installs the following components: ALE Windows Service - Mandatory. This option installs the Adaptive Log Exporter service, which is required to forward events to STRM. ALE Configuration User Interface - Select this check box to Install the Adaptive Log Exporter user interface. Clearing this check box installs the Adaptive Log Exporter without the user interface and requires text-based configuration files. NOTE Installing the Adaptive Log Exporter without the user interface is intended for advanced users only. For additional information, see Installing and Configuring ALE Using the CLI. Step 9 Step 10 Click Next. Type a name for the Adaptive Log Exporter Start menu folder. If you do not want to include an Adaptive Log Exporter folder in your Start menu, select the Don t create a Start Menu folder check box.
Installing and Configuring ALE Using the CLI 19 Step 11 Step 12 Step 13 Step 14 Step 15 Click Next. The Select Additional Tasks window is displayed. Configure the available options: Create a desktop icon - Select this check box to create an icon on your desktop for the Adaptive Log Exporter. You can also select one of the following options: - For all users - Select this check box to install a desktop icon for all users. - For the current user only - Select this check box to install a desktop icon for the logged in user. Create a Quick Launch icon - Select the check box to create an icon on your Quick Launch toolbar. Run service now - Select the Run Service Now check box to launch the service after the installation is complete. Click Next. The Ready to Install window is displayed. Click Install. The Completing the Setup Wizard is displayed when the installation is complete. Click Finish. NOTE If an error occurs when attempting to launch the Adaptive Log Exporter, you must run the program using the Run as administrator option in Windows. When the installation process completes, you must configure the location that the Adaptive Log Exporter uses for updates. These updates download the latest device plug-ins for the Adaptive Log Exporter. For more information, see Configuring the Update Site. Installing and Configuring ALE Using the CLI The command line interface (CLI) allows you to install, uninstall, and update devices for the Adaptive Log Exporter without the installation wizard. This document provides information on using the command line interface (CLI) and the available options. The command line interface allows you to update or deploy your Adaptive Log Exporter to multiple remote systems using third-party products that provide remote or batch installs, for example, MSI Packaging Tools, Message-Oriented Middleware (MOM), or System Center Configuration Manager (SCCM). The procedures in this document assume an advanced knowledge of network administration. This section includes the following topics: Basic Adaptive Log Exporter CLI Installation
20 INSTALLING THE ADAPTIVE LOG EXPORTER Advanced Installation with Windows Event Log Monitoring Uninstalling the Adaptive Log Exporter Adaptive Log Exporter CLI Utility Examples Basic Adaptive Log Exporter CLI Installation Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 To install the Adaptive Log Exporter using a CLI: Download the Adaptive Log Exporter setup file from the Juniper customer support website: www.juniper.net/support/products/strm/ After you download the Adaptive Log Exporter, you must decide on a distribution method to deploy the Adaptive Log Exporter to remote systems in your network. Close all other active applications before installing the Adaptive Log Exporter. From your desktop, select Start > Run. The Run window is displayed. Type the following command: cmd Click OK. The command line interface (CLI) is displayed. Navigate to the download directory of the Adaptive Log Exporter. In the CLI, type the following command: AdaptiveLogExporter_setup.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES NOTE You might require additional installation parameters. For more information, see Table 2-1. The SP-, VERYSILENT, and SUPPRESSMSGBOXES parameters are required parameters for a silent installation without launching the installation wizard or when using optional installation parameters. Installation commands must be run from the directory containing the Adaptive Log Exporter setup file.
Installing and Configuring ALE Using the CLI 21 Step 8 Configure optional installation parameters. Table 2-1 Optional Installation Parameters Parameter /DIR /COMPONENTS /NOICONS /GROUP Type the fully qualified path name to specify a non-standard installation directory for the Adaptive Log Exporter. For example, /DIR= D:\Windows Event Tools If you do not specify a directory for the installation, the Adaptive Log Exporter is installed in the Program Files or Program Files (x86) directory. Type the following command to specify individual components you want to install. The options include: main - Allows you to install the Adaptive Log Exporter service without the configuration wizard. For example, /COMPONENT=main ui - Allows you to install the configuration wizard with the Adaptive Log Exporter service. For example, /COMPONENT=main,ui If you do not include the component parameter, then the service and configuration wizard are installed. Type the following command if you do not want to include the Adaptive Log Exporter icon to display in your Start menu options. For example, /NOICONS By default, the Start menu displays the application in a folder named Adaptive Log Exporter. The group parameter allows you to define a new group name or add the icon to an existing group. For example, /Group= System or /Group= Accessories\System Tools Note: If you specify an existing group name, the Adaptive Log Exporter icon is added to the existing folder or sub folder. Advanced Installation with Windows Event Log Monitoring The default installation of the Adaptive Log Exporter only includes two device plug-ins: Windows Event Log and the File Forwarder plug-in. The advanced installation parameters for the Adaptive Log Exporter command line allow you to configure a Windows Event Log device plug-in during the installation. The advanced installation commands are typically used to install the Adaptive Log Exporter on the remote Windows host to monitor Windows events from the installation location.
22 INSTALLING THE ADAPTIVE LOG EXPORTER Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 To install the Adaptive Log Exporter with Windows Event Log monitoring: Copy the AdaptiveLogExporter_setup.exe to the remote location. From the desktop of the remote machine, select Start > Run. The Run window is displayed. Type the following command: cmd Click OK. The command line interface (CLI) is displayed. Navigate to the directory containing the AdaptiveLogExporter_setup.exe file. Type the following command to install the Adaptive Log Exporter using additional parameters, if required. For example, AdaptiveLogExporter_setup.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES /COMPONENT=main /MONITOR= Application, Security, System /MONITORDEST=10.100.100.100:514 /MONITORPROTO=TCP /DEVICEADDRESS=%computername% The example above installs the Adaptive Log Exporter service on the remote Windows host and configures the Windows Event Log. The Windows Event log collects application, security, and system logs from the local installation and forwards the events to the STRM Console or Event Collector at 10.100.100.100 using TCP on port 514.
Installing and Configuring ALE Using the CLI 23 Table 2-2 Windows Event Log Monitoring Parameters Parameter /MONITOR /MONITORDEST /MONITORPROTO Allows you to specify the list of event logs you want to monitor on the Windows operating system. The following Windows event logs can be monitored: Application Security System **Directory Service **DNS Server **File Replication The event log types must be separated using a comma-separated list. For example, /MONITOR= Application, Security, System, Di rectory Service, DNS Server Note: The ** indicates that these Windows Event Logs can be configured using the command line to collected events, but the check boxes for these event types are not displayed in the configuration until you update your Windows Event Log device plug-in. Allows you to specify the syslog destination that you want to receive the events. The IP address you type should be the address of your STRM Console or Event Collector. For example, /MONITORDEST=10.100.100.100:514 If you do not specify a port number, the default of port 514 is used for forwarding syslog events. Allows you to select the protocol to use when sending syslog events to STRM. The protocol can be specified as TCP or UDP. For example, /MONITORPROTO=TCP or /MONITORPROTO=UDP If this parameter is not defined, the Adaptive Log Exporter service defaults to sending events using UDP.
24 INSTALLING THE ADAPTIVE LOG EXPORTER Table 2-2 Windows Event Log Monitoring Parameters (continued) Parameter /DEVICEADDRESS Type the hostname or IP address for the device providing the Windows events to STRM. For example, /DEVICEADDRESS=10.100.100.100 or /DEVICEADDRESS=workstation102 or /DEVICEADDRESS=%COMPUTERNAME% Note: The device address field allows you to include system variables for bulk installations of the Adaptive Log Exporter. For example, %computername%. Adaptive Log Exporter CLI Utility Examples This section provides additional examples of using the CLI utility including: Batch File Command Line Install Script Full Adaptive Log Exporter Installation Installing the Adaptive Log Exporter Service Only Service Only Installation Monitoring the Windows Security Log Full Install Monitoring Windows Logs Batch File Command Line Install Script The following batch file contains an example script you can use to install the Adaptive Log Exporter on a remote Windows host. You must download the associated installation files and create a Windows share. The script copies the source files from a Windows share, installs the Adaptive Log Exporter and the Windows Event Plug-in, and configures the host to forward all Microsoft Windows events to STRM. copy \\SERVER\SHARE\AdaptiveLogExporter_setup.exe c:\ copy \\SERVER\SHARE\ALE_WindowsEventLogPlugin_setup.exe c:\ FOR /F "usebackq" %%i IN (`hostname`) DO SET MYHOST=%%i AdaptiveLogExporter_setup.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES /NOICONS /COMPONENTS=main,ui /MONITOR="Application","Security","System","Directory Service","DNS Server","File Replication Service" /MONITORDEST=<STRM IP>:514 /DEVICEADDRESS=%MYHOST% ALE_WindowsEventLogPlugin_setup.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES /PATCHONLY del c:\ale_windowseventlogplugin_setup.exe del c:\adaptivelogexporter_setup.exe
Installing and Configuring ALE Using the CLI 25 Where <STRM IP> is the IP address or hostname of your STRM Console or Event Collector. NOTE The Directory Service, DNS Server, and File Replication events are collected by the Adaptive Log Exporter; however, the configuration interface does not display the check boxes until after you update your device plug-ins. Full Adaptive Log Exporter Installation Using the command for the full install requires that you update your device plug-ins and configure devices. The above command installs the Adaptive Log Exporter only. To fully install the Adaptive Log Exporter, including the service and the wizard interface, type the following command: AdaptiveLogExporter_setup.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES /COMPONENTS=main,ui Installing the Adaptive Log Exporter Service Only The Adaptive Log Exporter can be installed using the command line with or without the wizard interface. Installing the service only allows you to install the service remotely to forward events, but still requires additional parameters to forward Windows events to STRM. To install the Adaptive Log Exporter service only, type the following command: AdaptiveLogExporter_setup.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES /COMPONENTS=main NOTE If you install the service without additional Windows Event Log parameters, you must update your devices using the ALE_WindowsEventLogPlugin_setup.exe. For more information, see Updating a Windows Event Log Configuration. Service Only Installation Monitoring the Windows Security Log To install the Adaptive Log Exporter service without the configuration wizard and monitor Windows security logs for the local host, type the following command: AdaptiveLogExporter_setup.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES /COMPONENTS=main /MONITOR= Security /MONITORDEST=10.10.100.100 /DEVICEADDRESS=Device hostname or IP address NOTE In the example above, STRM is located at IP address 10.10.100.100.
26 INSTALLING THE ADAPTIVE LOG EXPORTER Full Install Monitoring Windows Logs To fully install the Adaptive Log Exporter, including the configuration wizard and preconfigure a Windows Security Logs, type the following command: AdaptiveLogExporter_setup.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES /COMPONENTS=main,ui /MONITOR= Security, Application, System /MONITORDEST=10.10.100.100 /DEVICEADDRESS=%COMPUTERNAME% The command line installs the Adaptive Log Exporter, and then configures the Security, Application, and System logs. Uninstalling the Adaptive Log Exporter Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 To uninstall the Adaptive Log Exporter using a CLI: Close all active applications on the Windows host. On your desktop, select Start > Run. The Run window is displayed. Type the following: cmd Click OK. The command line interface (CLI) is displayed. Navigate to the download directory of the Adaptive Log Exporter. In the CLI, type the following: unins000.exe /SILENT /VERYSILENT Windows 2008 and Windows 7 Operating Systems can require user intervention to accept the User Account Control (UAC) prompt before the uninstall can complete. For more information about UAC settings, see your Microsoft Operating System documentation. If the command fails to uninstall the Adaptive Log Exporter, you must verify the name of the uninstall file is correct. The uninstall can be named unins001.exe.
3 CONFIGURING ADAPTIVE LOG EXPORTER UPDATES After you have installed the Adaptive Log Exporter, you must complete the following configuration steps to update your device plug-ins: 1 Configure the update site to install device plug-ins for the Adaptive Log Exporter. For more information, see Configuring the Update Site. NOTE If your host does not have Internet connectivity, see Configuring Updates for Off-line Sites. 2 Optional. Configure a schedule to look for updated device plug-ins. For more information, see Scheduling Automatic Updates. 3 Optional. Configure preferences for future plug-in updates. For more information, see Configuring Automatic Update Preferences Configuring the Update Site The update site allows you to specify a download location for device plug-in files required by the Adaptive Log Exporter. Device plug-ins are important because they contain updates for parsing events and can include new event types or event categories. Step 1 Step 2 Step 3 Step 4 To configure an update site: From the Start menu, select Programs > Adaptive Log Exporter > Configure Adapter Log Exporter. The Adaptive Log Exporter is displayed. On the main menu, select File > Preferences. The Preferences window is displayed. Click the + icon to expand the Install/Update navigation tree. On the navigation menu, select Update Site. Update Site parameters are displayed.
28 CONFIGURING ADAPTIVE LOG EXPORTER UPDATES Step 5 In the Update Site URL field, type the location of your update site file. For example, To update from the Internet, type a URL: http://downloads.q1labs.com/windowsagent To update from a Windows share, type the path to your server: file://<somewindowsserver>/ale/updatesite To update from a local file, type the path to the file: file:///e:/updatesite NOTE If you choose a Windows server or local file, you must download the ALEUpdateSite.zip file from the Juniper customer support website and extract the file to a Windows share or file repository. The update site file is located at the following address: https://download.juniper.net/software/strm/2012.1/adaptivelogexporter_setup.zip. For more information, see Configuring Updates for Off-line Sites. Step 6 Step 7 Step 8 Step 9 Step 10 Click Apply. Click OK. On the toolbar, click Add Plugins. Click the + to expand the device list. Choose one of the following options: a b To install all available device plug-ins, select the top level check box. To install specific device plug-ins, select a check box for each device plug-in to install. NOTE The Show the latest version of a feature only and the Filter features included in other features on the list check boxes are for future development purposes only. We recommend that you use the default values for these check boxes. Step 11 Step 12 Step 13 Step 14 To install all dependent plug-ins, click Select Required. If you selected device plug-ins that requires additional software an error can display. Click Error Details for additional information. Click Next. The Feature License window is displayed. Read the license associated with the selected device. To continue, you must select the I accept the terms of the license agreement option. Click Next. The Installation Window is displayed.
Configuring Updates for Off-line Sites 29 NOTE You must install your device plug-ins to the default location. Step 15 Step 16 Click Finish. The Feature Verification window is displayed. Click Install All to install all chosen devices. After the device plug-in installations complete, you are ready to configure your syslog destination. For more information, see Managing Destinations. Configuring Updates for Off-line Sites Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 The Adaptive Log Exporter might be configured on a host that does not have Internet connectivity. This is often the case when the Adaptive Log Exporter is used on hardened network assets. For these systems we recommend you download and configure a local site for updating the Adaptive Log Exporter device plug-ins. To configure a local update site: From a system with Internet connectivity, download the following file: https://download.juniper.net/software/strm/2012.1/aleupdatesite.zip Copy the file to the Adaptive Log Exporter host or a local Windows share. Extract the file. You must keep the folder and directory structure intact when you extract the ALEUpdateSize.zip file. From the Start menu, select Programs > Adaptive Log Exporter > Configure Adapter Log Exporter. The Adaptive Log Exporter is displayed. From the main menu, select File > Preferences. The Preferences window is displayed. Click the + icon to expand the Install/Update navigation tree. From the navigation menu, select Update Site. Update Site parameters are displayed. In the Update Site URL field, type the location of your update site file. For example, To update from a Windows share, type the path to your server: file://<somewindowsserver>/ale/updatesite To update from a local file, type the path to the file: file:///e:/updatesite Click Apply. Click OK.
30 CONFIGURING ADAPTIVE LOG EXPORTER UPDATES Step 11 Step 12 Step 13 From the toolbar, click Add Plugins. Click the + to expand the device list. Choose one of the following options: a b To install all available device plug-ins, select the top level check box. For example, in the above window, select the Juniper Networks Juniper customer support check box. To install specific device plug-ins, select a check box for each device plug-in to install. NOTE The Show the latest version of a feature only and the Filter features included in other features on the list check boxes are for future development purposes only. We recommend that you use the default values for these check boxes. Step 14 Step 15 Step 16 Step 17 To install all dependent plug-ins, click Select Required. If you selected device plug-ins that requires additional software an error can display. Click Error Details for additional information. Click Next. The Feature License window is displayed. Read the license associated with the selected device. To continue, you must select the I accept the terms of the license agreement option. Click Next. The Installation Window is displayed. NOTE You must install your devices to the default location. Therefore, do not change the Install Location for your devices. Step 18 Step 19 Click Finish. The Feature Verification window is displayed. Click Install All to install all chosen devices. After the device plug-in installations complete, you are ready to configure your syslog destination. For more information, see Managing Destinations. Scheduling Automatic Updates Step 1 You can configure the Adaptive Log Exporter to automatically search for device plug-in updates. Device plug-in updates are important because they often contain event parsing updates and can include new event types or event categories. To schedule automatic updates: From the Start menu, select Programs > AdaptiveLogExporter > Configure Adapter Log Exporter.
Configuring Automatic Update Preferences 31 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 On the toolbar, select File > Preferences. The Preferences window is displayed. In the navigation manu, click the + sign next to Install/Update. Additional menu options are displayed. Click Automatic Updates. The Automatic Updates parameters are displayed. Select the Automatically find new updates and notify me check box. Select one of the following options to schedule automatic updates: Look for updates each time platform is started - Enables the system to search for updates each time you start your Adaptive Log Exporter. This is the default. Look for updates on the following schedule - Allows you to schedule a specific time for searching for updates. Select one of the following options for downloading updates: Search for updates and notify me when they are available - Enables notifications when device updates are available. Download new updates automatically and notify me when ready to install them - Enables the system to download updates automatically and notifies you when the updates are ready to install. Click Apply. Click OK. The automatic update schedule is complete. Configuring Automatic Update Preferences Step 1 Step 2 Step 3 Step 4 After you have updated your device plug-ins, you can define the content installed in future device plug-in updates. To configure your update preferences: From the Start menu, select Programs > Adaptive Log Exporter > Configure Adapter Log Exporter. The Adaptive Log Exporter is displayed. From the main menu, select File > Preferences. The Preferences window is displayed. Click Install/Update. The Install/Update parameters are displayed. In the Maximum number of History configurations field, type the number of configuration changes you want the system to maintain. The default is 100.
32 CONFIGURING ADAPTIVE LOG EXPORTER UPDATES Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Select the Check digital signatures of downloaded archives check box. By default, this check box is selected to prevent unauthorized or unsigned signatures from being installed. Select one of the following update options: equivalent - Equivalent updates include device plug-ins that are at the same revision level as your Adaptive Log Exporter application. compatible - Compatible updates include any device plug-ins that work with your Adaptive Log Exporter regardless of the software revision of the device plug-in. To define a specific update policy, specify a URL in the Policy URL field. This update policy is useful if your deployment includes many Adaptive Log Exporters. If this is the case, you might need to schedule event uploads to minimize the potential high load on the network. For assistance creating a custom update policy, contact Juniper Networks Customer Support. To define specific proxy settings for your updates: a Select the Enable HTTP Proxy connection check box. b In the HTTP proxy host address field, type the IP address of the desired proxy host. c In the HTTP proxy host port field, type the port number of the proxy host. Click Apply. Click OK.
4 MANAGING DESTINATIONS Destinations in the Adaptive Log Exporter allow you to create a syslog forwarding destination for events and map specific devices to the destination address. This allows you to create unique destinations for each of the device plug-ins in your network, but in most cases, you only need to map your devices directly to your STRM Console or Event Collector. The Adaptive Log Exporter allows you to create three types of destinations: Syslog TCP - Allows you to forward syslog events using the TCP protocol on the port of your choosing. Syslog UDP - Allows you to forward syslog events using the UDP protocol on the port of your choosing. Logger - Allows you to log events to a local file on the Adaptive Log Exporter host. Configuring Destinations The destination provides the Adaptive Log Exporter with an event forwarding destination for event logs. You must configure the destination before you configure individual device plug-ins for the Adaptive Log Exporter. These destinations are then mapped to the device plug-in, which allows each device to forward events to the appropriate destination. This section includes the following topics: Adding a Syslog TCP Destination Adding a Syslog UDP Destination Adding a Logger Destination Editing a Destination Deleting a Destination